FlowiseAI Flowise: Sandbox escape to remote code execution via LocalFileStore

Summary

Flowise through version 3.1.4 contains a sandbox escape in the custom function feature. An authenticated user can submit JavaScript to the node-custom-function API that writes a file into the mammoth package and requires it, which escapes the vm2 sandbox and executes operating system commands as the Flowise process user. The attack requires the ALLOW_BUILTIN_DEP setting to be true.

Affected

• Flowise 0 to 3.1.4 (according to the VulnCheck CNA record)
• Exploitation requires ALLOW_BUILTIN_DEP=true

Fixed in

Unknown. The fixed version has not been confirmed by the vendor. Do not rely on the fix for the related CVE-2026-73483 (GHSA-9gvv-qjj3-2p6g), which is a different vulnerability with patched version 3.1.3.

Workaround

• Set ALLOW_BUILTIN_DEP to false or leave it unset, if your use case allows it
• Restrict access to the /api/v1/node-custom-function endpoint at the reverse proxy
• Run the Flowise container or process as a non-root user

Exploitation

• Not known to be exploited in the wild according to OffSeq; ambiguous honeypot reports exist, so exploitation is not confirmed
• No public proof of concept specific to this CVE is known
• Attack requires a valid user account (PR:L)

Our recommendation

• Inventory all Flowise instances and their versions
• Check whether ALLOW_BUILTIN_DEP is enabled and disable it if possible
• Restrict Flowise accounts and disable self-registration; keep instances off the public internet
• Run Flowise as a non-root user and limit the secrets (API keys, LLM credentials) stored in it
• Upgrade to the latest Flowise release once the vendor confirms a fixed version
• Monitor the Flowise GitHub security advisories for updates

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Flowise GitHub repository github.com
• VulnCheck advisory www.vulncheck.com
• GitHub Advisory GHSA-9gvv-qjj3-2p6g (related CVE) github.com
• Flowise utils.ts at vulnerable commit github.com
• VulDB entry vuldb.com
• OffSeq radar entry radar.offseq.com
• The Hacker News: Flowise AI agent builder under active attack thehackernews.com
• OSV GHSA-9gvv-qjj3-2p6g osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:57.